CVE-2026-80779net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8eeed8373e1cca836799bf8e4a05cffa8e444908 before 881a805a8029ba48c0ce81c6674910f8d83f7afb; from 8eeed8373e1cca836799bf8e4a05cffa8e444908 before 39fc615e355b65b8d43be30da57aa95ae6eaf688; from 8eeed8373e1cca836799bf8e4a05cffa8e444908 before f3868046e8e2e761d4d943a232bd109ff22a7d5b; from 8eeed8373e1cca836799bf8e4a05cffa8e444908 before ea081b4435515ac7177eb598a3c0678d1b9e7911; from 8eeed8373e1cca836799bf8e4a05cffa8e444908 before d92255b405fb6f5acca408239ccd742e0a42c9cb | CNA record |
References
- https://git.kernel.org/stable/c/881a805a8029ba48c0ce81c6674910f8d83f7afb
- https://git.kernel.org/stable/c/39fc615e355b65b8d43be30da57aa95ae6eaf688
- https://git.kernel.org/stable/c/f3868046e8e2e761d4d943a232bd109ff22a7d5b
- https://git.kernel.org/stable/c/ea081b4435515ac7177eb598a3c0678d1b9e7911
- https://git.kernel.org/stable/c/d92255b405fb6f5acca408239ccd742e0a42c9cb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.